ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-07-23 12:31:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore(gcp): enhance metadata for gcr service (#9644)

Browse Source 
Co-authored-by: HugoPBrito <hugopbrit@gmail.com>
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com>
This commit is contained in:
Rubén De la Torre Vico
2026-02-13 15:55:00 +01:00
committed by GitHub
parent b436da27c8
commit cceaf1ea54
3 changed files with 26 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
prowler/CHANGELOG.md
+1
View File
@@ -31,6 +31,7 @@ All notable changes to the **Prowler SDK** are documented in this file.
- Update GCP Compute Engine service metadata to new format [(#9641)](https://github.com/prowler-cloud/prowler/pull/9641)
- Update GCP Dataproc service metadata to new format [(#9642)](https://github.com/prowler-cloud/prowler/pull/9642)
- Update GCP DNS service metadata to new format [(#9643)](https://github.com/prowler-cloud/prowler/pull/9643)
- Update GCP GCR service metadata to new format [(#9644)](https://github.com/prowler-cloud/prowler/pull/9644)
### 🔐 Security
prowler/providers/gcp/services/gcr/gcr_container_scanning_enabled/gcr_container_scanning_enabled.metadata.json
+21 -16
View File
@@ -1,33 +1,38 @@
{
"Provider": "gcp",
"CheckID": "gcr_container_scanning_enabled",
"CheckTitle": "Ensure Image Vulnerability Scanning using GCR Container Scanning or a third-party provider",
"CheckType": [
"Security",
"Configuration"
],
"CheckTitle": "Project has GCR Container Scanning API enabled",
"CheckType": [],
"ServiceName": "gcr",
"SubServiceName": "Container Scanning",
"SubServiceName": "",
"ResourceIdTemplate": "",
"Severity": "medium",
"ResourceType": "Service",
"ResourceGroup": "container",
"Description": "Scan images stored in Google Container Registry (GCR) for vulnerabilities using GCR Container Scanning or a third-party provider. This helps identify and mitigate security risks associated with known vulnerabilities in container images.",
"Risk": "Without image vulnerability scanning, container images stored in GCR may contain known vulnerabilities, increasing the risk of exploitation by malicious actors.",
"RelatedUrl": "https://cloud.google.com/container-registry/docs/container-analysis",
"ResourceType": "serviceusage.googleapis.com/Service",
"Description": "**Google Cloud projects** with `containerscanning.googleapis.com` enabled perform **automatic vulnerability scanning** for images in Container Registry and Artifact Registry.\n\nThe finding indicates whether that service is active to generate and refresh vulnerability metadata for your container images.",
"Risk": "Without **image scanning**, vulnerable packages can reach production unchecked, enabling:\n- **Remote code execution** or **privilege escalation** (integrity/availability)\n- **Data exfiltration** from compromised workloads (confidentiality)\n- **Supply chain compromise** via unvetted base images",
"RelatedUrl": "",
"AdditionalURLs": [
"https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/ArtifactRegistry/enable-vulnerability-analysis.html",
"https://cloud.google.com/container-registry/docs/container-analysis",
"https://docs.cloud.google.com/artifact-analysis/docs/enable-automatic-scanning",
"https://cloud.google.com/container-registry/docs/container-best-practices"
],
"Remediation": {
"Code": {
"CLI": "gcloud services enable containerscanning.googleapis.com",
"NativeIaC": "",
"Other": "",
"Terraform": "https://docs.prowler.com/checks/gcp/google-cloud-networking-policies/ensure-gcp-gcr-container-vulnerability-scanning-is-enabled#terraform"
"Other": "1. In the Google Cloud console, go to APIs & Services > Library\n2. Search for \"Container Scanning API\"\n3. Click the result and then click \"Enable\"",
"Terraform": "```hcl\nresource \"google_project_service\" \"<example_resource_name>\" {\n project = \"<example_project_id>\"\n service = \"containerscanning.googleapis.com\" # Critical: enables Container Scanning API to pass the check\n}\n```"
},
"Recommendation": {
"Text": "Enable vulnerability scanning for images stored in GCR using GCR Container Scanning or a third-party provider.",
"Url": "https://cloud.google.com/container-registry/docs/container-best-practices"
"Text": "Enable `containerscanning.googleapis.com` and integrate results into CI/CD gates. Apply **defense in depth**:\n- Use **Binary Authorization** to block noncompliant images\n- Enforce **least privilege** over who can disable scanning\n- Rebuild and patch frequently; prefer trusted, signed base images",
"Url": "https://hub.prowler.com/check/gcr_container_scanning_enabled"
}
},
"Categories": [],
"Categories": [
"vulnerabilities",
"container-security"
],
"DependsOn": [],
"RelatedTo": [],
"Notes": "By default, GCR Container Scanning is disabled."
prowler/providers/gcp/services/gke/gke_cluster_no_default_service_account/gke_cluster_no_default_service_account.metadata.json
+4 -1
View File
@@ -30,5 +30,8 @@
"Categories": [],
"DependsOn": [],
"RelatedTo": [],
"Notes": "By default, nodes use the Compute Engine default service account when you create a new cluster."
"Notes": "By default, nodes use the Compute Engine default service account when you create a new cluster.",
"AdditionalURLs": [
"https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/GKE/ensure-service-account-is-not-the-default-compute-engine-service-account.html"
]
}